10 ms·

I doubt the web will ever be fully encrypted. There will always be tons of people who don't care enough. I've come across dozens of high information static webs

by shpx 9y ago

I doubt the web will ever be fully encrypted. There will always be tons of people who don't care enough. I've come across dozens of high information static websites that were set up like 10+ years ago where the author will probably never be back to configure tls. It's so strange that you have to ask someone's permission to use encryption[0]. Certificate authorities should've been (should be?) optional. SSH came out around the same time and its Trust-on-First-Use is a much better system. [0] https://www.tedunangst.com/flak/post/moving-to-https https://www.tedunangst.com/flak/post/moving-to-https https://en.wikipedia.org/wiki/Trust_on_first_use https://en.wikipedia.org/wiki/Trust_on_first_use

wahern 9y ago
The original impetus for SSL/TLS was to permit credit card transactions. For a long time only banking websites and retail checkout pages were encrypted. In that light it makes more sense why the industry focused so heavily on certificate authorities. People were told never to enter their credit card number unless the "secure" icon was displayed; if it did, then they could trust the site much like they would trust any brick & mortar store. Back in the early days you couldn't get a certificate without faxing in a copy of your business registration. A certificate authority's digital imprimatur implied something substantial about the credibility of a site, however imperfect the process. But as the certificate authority market diversified there was a race to the bottom in terms of credible certificate authorities. We've been at that bottom for so long that it does seem ridiculous that we didn't have Let's Encrypt earlier.
- kunimu 9y ago
  >For a long time only banking websites and retail checkout pages were encrypted. For my experience, this still holds in Japan, and I've heard in Korea.
  - jchw 9y ago
    Anecdotal evidence, but for Japan that seems to be changing. Popular Japanese art site Pixiv rolled out TLS to the entire site in the past year or so, before that it was only used during login. As far as Korea goes, they've got a whole different bag of worms going on, at least for a couple more years. Look up "South Korea Internet Explorer" for some astounding stuff if you've not heard of this before.
- Fnoord 9y ago
  > Back in the early days you couldn't get a certificate without faxing in a copy of your business registration. Well well, guess who could easily spoof that one. > A certificate authority's digital imprimatur implied something substantial about the credibility of a site, however imperfect the process. Not just the process. SSL downplay attacks and lack of certificate pinning already existed back in those days. As long as those attacks are unknown you may still be reasonably secure against a MITM from a banana state government or a random ISP. Also, lets not forget that running your entire website on HTTPS was expensive on resources before the 10s. So the argument "because we can" makes sense. That doesn't mean all that information has to be encrypted. However, if you want to harm a surveillance state, then one act is causing significant noise. Uninteresting, encrypted data is noise and potentially yields plausible deniability. The other argument is "because we have to". Different attacks have been demonstrated on that one: hostile networks such as ISPs injecting ads, hijacking DNS, open WiFi, impersonating fraudulent websites are just a few examples.
  - wlll 9y ago
    > Well well, guess who could easily spoof [faxing in a copy of your business registration]. I worked for an ISP in 2000 and we had to both send and receive faxes on "company headed notepaper" as a means of authenticating a request. All you needed was a word doc with the company name in bold at the top of the page. When we hit this particular bureaucratic speed bump (mostly dealing with domain name registrars), and having no "company headed notepaper" ourselves (we were 20 people) we just fabricated it. It always worked.
cortesoft 9y ago
I think SSH and HTTPS have very different use cases, which is why their cert structure is different. Most people ssh to servers they either own or have a working relationship with. Https, on the other hand, is very often used to connect to sites that you have no relationship with, but you still want to know that you are connecting to who you think you are. SSH works on the premise that you should know, or have a way to check, the key for the server you are connecting to. That really doesn't happen with HTTPS.
greenhouse_gas 9y ago
The thing is that: 1. TOFU won't scale - if I have a single SSH host, I can easily verify the server key out of band, and then never change it (though that's quite an insecure proposition if you ask me). How would you do this to _every single website you visit?_ And if you don't verify out-of-band (like calling up the host), how do you know that you're not being massively MITMed? And then when you leave your house and go to an airport and get a "your certificate changed", all it means is that _now_ you're connecting to the real page, and not MITM page. And even if you verified the original cert and now get a "site certificate has changed". It could mean that the owner rotated his private key. What do you do? 99% will just say "false alarm, ignore, move on". 2. WoT - It's a false sense of security. You're trusting that random people on the internet will 1. Bother doing _any_ verification before signing someone's key and 2. People will keep their private keys safe from botnets. And the network has perverse incentive - the less verification a group does, the more cross-signing they'll do, the more "trusted" it is.
- pishpash 9y ago
  Exactly, a stolen key and no verification and you're back to traffic in the clear. Just because you do some encryption doesn't mean you're somehow protected.
- dheera 9y ago
  Of course, airports will DNS poison you to serve up the stupid Wi-Fi ToS. google.com never loads due to a HTTPS error, so at airports I usually use aoeu.com or some other non-encryted site to agree to the ToS-by-poisoning.
  - cytzol 9y ago
    neverssl.com has saved me several times.
    - quickthrower2 9y ago
      WarriorForum.com for me!
  - 9y ago
nvr219 9y ago
> I doubt the web will ever be fully encrypted. There will always be tons of people who don't care enough. I'm one of those people. The grocery list app I use doesn't use SSL and I don't really care because it's just my grocery list lol.
- hunter2_ 9y ago
  Right now it's just your grocery list. In the future when it's sucked up into the algorithms used by the underwriters of your health insurance and life insurance, and you can't quite figure out why you aren't getting the healthy-eating-disguised-with-some-ambiguous-name discount, maybe your grocery selection is to blame.
  - elmigranto 9y ago
    How is SSL going to help? I assume you are hinting at app operator will sell user’s data? Or do you mean parent’s network provider does? I guess in latter case SSL would help, but what’s more likely, though, operator selling out or app developer?
    - tveita 9y ago
      > I assume you are hinting at app operator will sell user’s data? Or do you mean parent’s network provider does? Yes and yes. ISPs are racing as we speak to develop the technology to data mine their users and inject their own ads. Hopefully we will get the web encrypted fast enough to make it less economically attractive. They want to know which sites you visit, what you search for, which movies you watch and what you shop for, and package it and sell it to anyone who will pay. Individual developers could do the same, and we should find ways to prevent that, but they have less negotiating and lobbying power and users have more choice in what apps to use.
- cm2187 9y ago
  If there is any password involved you should care. Perhaps you use nice rabdom unique passwords, but most users won’t.
jaas 9y ago
> I doubt the web will ever be fully encrypted. There will always be tons of people who don't care enough. I don't think the Web will become fully encrypted by virtue of everyone caring enough to move to HTTPS. The knockout punch for unencrypted sites will come when browsers make the decision to not load plain HTTP sites by default in order to protect their users. At that point, for the vast majority of people, the Web will be 100% HTTPS because they'll never see a site that isn't HTTPS. We just have to get the encryption percentage high enough to allow browsers to finish the job.
- Gracana 9y ago
  What about the other part, the vast quantities of information that will never be encrypted because the sites remain but the people have moved on or are gone? Why does that deserve a knockout punch?
  - hunter2_ 9y ago
    Not trying to defend the idea, but the domain will expire at whatever point the registrant doesn't fund renewal anyway. Is that potentially arbitrary sunset date "better" by virtue of being more distant? If the authors care to let the sites exist yet prefer to abandon stewardship now, they should transfer ownership now and to someone who cares enough to encrypt as needed.
    - Santosh83 9y ago
      Some of these sites may be on shared hosting where the hosting provider doesn't provide SSL for custom domains, or provides it for a fee which is unjustifiable to the website author[s], so it may not even be that they don't care enough, but that they don't want to shell out personal money for say a static, hobbyist website.
      - Nilsson 9y ago
        Well, there's always services like CloudFlare which would offer free certificates - thus even allowing for pages hosted on GitHub Pages to be served through HTTPS.
ehsankia 9y ago
Honestly question, is there any reason why a static website should have SSL? Unless you have encrypted DNS, whoever is stealing the data will know the server you're connecting to, and therefore will have all the exact data anyways. So HTTPS is quite literally a waste, no? Sorry for the ignorance, it's a legitimate question.
- greenhouse_gas 9y ago
  The server, but not the URL. And they can't _modify_ content.
- mnordhoff 9y ago
  A number of web pages from better writers than me will argue why you need HTTPS. E.g. it provides integrity (so the coffee shop WiFi can't insert ads in your site), and browsers only enable some features on HTTPS sites. https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/
- boomlinde 9y ago
  See it not only as encryption, but a sealed envelope that verifies the integrity of the website which could otherwise be compromised by a man in the middle, unfortunately often an ISP to insert billing reminders, ads and promotions. Perhaps more nefariously by a hacker to replace your bitcoin wallets and Paypal links with his own...
- vertex-four 9y ago
  Among other things, they can tell you're reading wikipedia but not that you're reading about <controversial subject of the day>, and they can tell that you're browsing youtube but not able to sell data that you watch PewDiePie every day. They're also prevented from messing with the data - providing incorrect information, blocking individual pages, and inserting advertisements.
- cesarb 9y ago
  Even if the site is supposed to be static, an active attacker can still inject dynamic code into it. In one somewhat recent example, a non-HTTPS page was modified in transit by an attacker to inject Javascript code which did a denial-of-service attack against github. Had the page used HTTPS, the attacker would not be able to inject that Javascript.
rootlocus 9y ago
> I doubt the web will ever be fully encrypted. n-gate.com will make sure of that http://n-gate.com/software/ http://n-gate.com/software/
csomar 9y ago
If browers start blocking unecrypted traffic then it will.

by shpx 9y ago

wahern 9y ago

The original impetus for SSL/TLS was to permit credit card transactions. For a long time only banking websites and retail checkout pages were encrypted. In that light it makes more sense why the industry focused so heavily on certificate authorities. People were told never to enter their credit card number unless the "secure" icon was displayed; if it did, then they could trust the site much like they would trust any brick & mortar store. Back in the early days you couldn't get a certificate without faxing in a copy of your business registration. A certificate authority's digital imprimatur implied something substantial about the credibility of a site, however imperfect the process. But as the certificate authority market diversified there was a race to the bottom in terms of credible certificate authorities. We've been at that bottom for so long that it does seem ridiculous that we didn't have Let's Encrypt earlier.

kunimu 9y ago
>For a long time only banking websites and retail checkout pages were encrypted. For my experience, this still holds in Japan, and I've heard in Korea.
- jchw 9y ago
  Anecdotal evidence, but for Japan that seems to be changing. Popular Japanese art site Pixiv rolled out TLS to the entire site in the past year or so, before that it was only used during login. As far as Korea goes, they've got a whole different bag of worms going on, at least for a couple more years. Look up "South Korea Internet Explorer" for some astounding stuff if you've not heard of this before.
Fnoord 9y ago
> Back in the early days you couldn't get a certificate without faxing in a copy of your business registration. Well well, guess who could easily spoof that one. > A certificate authority's digital imprimatur implied something substantial about the credibility of a site, however imperfect the process. Not just the process. SSL downplay attacks and lack of certificate pinning already existed back in those days. As long as those attacks are unknown you may still be reasonably secure against a MITM from a banana state government or a random ISP. Also, lets not forget that running your entire website on HTTPS was expensive on resources before the 10s. So the argument "because we can" makes sense. That doesn't mean all that information has to be encrypted. However, if you want to harm a surveillance state, then one act is causing significant noise. Uninteresting, encrypted data is noise and potentially yields plausible deniability. The other argument is "because we have to". Different attacks have been demonstrated on that one: hostile networks such as ISPs injecting ads, hijacking DNS, open WiFi, impersonating fraudulent websites are just a few examples.
- wlll 9y ago
  > Well well, guess who could easily spoof [faxing in a copy of your business registration]. I worked for an ISP in 2000 and we had to both send and receive faxes on "company headed notepaper" as a means of authenticating a request. All you needed was a word doc with the company name in bold at the top of the page. When we hit this particular bureaucratic speed bump (mostly dealing with domain name registrars), and having no "company headed notepaper" ourselves (we were 20 people) we just fabricated it. It always worked.

cortesoft 9y ago

I think SSH and HTTPS have very different use cases, which is why their cert structure is different. Most people ssh to servers they either own or have a working relationship with. Https, on the other hand, is very often used to connect to sites that you have no relationship with, but you still want to know that you are connecting to who you think you are. SSH works on the premise that you should know, or have a way to check, the key for the server you are connecting to. That really doesn't happen with HTTPS.

greenhouse_gas 9y ago

The thing is that: 1. TOFU won't scale - if I have a single SSH host, I can easily verify the server key out of band, and then never change it (though that's quite an insecure proposition if you ask me). How would you do this to _every single website you visit?_ And if you don't verify out-of-band (like calling up the host), how do you know that you're not being massively MITMed? And then when you leave your house and go to an airport and get a "your certificate changed", all it means is that _now_ you're connecting to the real page, and not MITM page. And even if you verified the original cert and now get a "site certificate has changed". It could mean that the owner rotated his private key. What do you do? 99% will just say "false alarm, ignore, move on". 2. WoT - It's a false sense of security. You're trusting that random people on the internet will 1. Bother doing _any_ verification before signing someone's key and 2. People will keep their private keys safe from botnets. And the network has perverse incentive - the less verification a group does, the more cross-signing they'll do, the more "trusted" it is.

pishpash 9y ago
Exactly, a stolen key and no verification and you're back to traffic in the clear. Just because you do some encryption doesn't mean you're somehow protected.
dheera 9y ago
Of course, airports will DNS poison you to serve up the stupid Wi-Fi ToS. google.com never loads due to a HTTPS error, so at airports I usually use aoeu.com or some other non-encryted site to agree to the ToS-by-poisoning.
- cytzol 9y ago
  neverssl.com has saved me several times.
  - quickthrower2 9y ago
    WarriorForum.com for me!
- 9y ago

nvr219 9y ago

> I doubt the web will ever be fully encrypted. There will always be tons of people who don't care enough. I'm one of those people. The grocery list app I use doesn't use SSL and I don't really care because it's just my grocery list lol.

hunter2_ 9y ago
Right now it's just your grocery list. In the future when it's sucked up into the algorithms used by the underwriters of your health insurance and life insurance, and you can't quite figure out why you aren't getting the healthy-eating-disguised-with-some-ambiguous-name discount, maybe your grocery selection is to blame.
- elmigranto 9y ago
  How is SSL going to help? I assume you are hinting at app operator will sell user’s data? Or do you mean parent’s network provider does? I guess in latter case SSL would help, but what’s more likely, though, operator selling out or app developer?
  - tveita 9y ago
    > I assume you are hinting at app operator will sell user’s data? Or do you mean parent’s network provider does? Yes and yes. ISPs are racing as we speak to develop the technology to data mine their users and inject their own ads. Hopefully we will get the web encrypted fast enough to make it less economically attractive. They want to know which sites you visit, what you search for, which movies you watch and what you shop for, and package it and sell it to anyone who will pay. Individual developers could do the same, and we should find ways to prevent that, but they have less negotiating and lobbying power and users have more choice in what apps to use.
cm2187 9y ago
If there is any password involved you should care. Perhaps you use nice rabdom unique passwords, but most users won’t.

jaas 9y ago

> I doubt the web will ever be fully encrypted. There will always be tons of people who don't care enough. I don't think the Web will become fully encrypted by virtue of everyone caring enough to move to HTTPS. The knockout punch for unencrypted sites will come when browsers make the decision to not load plain HTTP sites by default in order to protect their users. At that point, for the vast majority of people, the Web will be 100% HTTPS because they'll never see a site that isn't HTTPS. We just have to get the encryption percentage high enough to allow browsers to finish the job.

Gracana 9y ago
What about the other part, the vast quantities of information that will never be encrypted because the sites remain but the people have moved on or are gone? Why does that deserve a knockout punch?
- hunter2_ 9y ago
  Not trying to defend the idea, but the domain will expire at whatever point the registrant doesn't fund renewal anyway. Is that potentially arbitrary sunset date "better" by virtue of being more distant? If the authors care to let the sites exist yet prefer to abandon stewardship now, they should transfer ownership now and to someone who cares enough to encrypt as needed.
  - Santosh83 9y ago
    Some of these sites may be on shared hosting where the hosting provider doesn't provide SSL for custom domains, or provides it for a fee which is unjustifiable to the website author[s], so it may not even be that they don't care enough, but that they don't want to shell out personal money for say a static, hobbyist website.
    - Nilsson 9y ago
      Well, there's always services like CloudFlare which would offer free certificates - thus even allowing for pages hosted on GitHub Pages to be served through HTTPS.

ehsankia 9y ago

Honestly question, is there any reason why a static website should have SSL? Unless you have encrypted DNS, whoever is stealing the data will know the server you're connecting to, and therefore will have all the exact data anyways. So HTTPS is quite literally a waste, no? Sorry for the ignorance, it's a legitimate question.

greenhouse_gas 9y ago
The server, but not the URL. And they can't _modify_ content.
mnordhoff 9y ago
A number of web pages from better writers than me will argue why you need HTTPS. E.g. it provides integrity (so the coffee shop WiFi can't insert ads in your site), and browsers only enable some features on HTTPS sites. https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/
boomlinde 9y ago
See it not only as encryption, but a sealed envelope that verifies the integrity of the website which could otherwise be compromised by a man in the middle, unfortunately often an ISP to insert billing reminders, ads and promotions. Perhaps more nefariously by a hacker to replace your bitcoin wallets and Paypal links with his own...
vertex-four 9y ago
Among other things, they can tell you're reading wikipedia but not that you're reading about <controversial subject of the day>, and they can tell that you're browsing youtube but not able to sell data that you watch PewDiePie every day. They're also prevented from messing with the data - providing incorrect information, blocking individual pages, and inserting advertisements.
cesarb 9y ago
Even if the site is supposed to be static, an active attacker can still inject dynamic code into it. In one somewhat recent example, a non-HTTPS page was modified in transit by an attacker to inject Javascript code which did a denial-of-service attack against github. Had the page used HTTPS, the attacker would not be able to inject that Javascript.

rootlocus 9y ago

> I doubt the web will ever be fully encrypted. n-gate.com will make sure of that http://n-gate.com/software/ http://n-gate.com/software/

csomar 9y ago

If browers start blocking unecrypted traffic then it will.